# Cloudflared tunnel — outbound-only edge for the homelab.
#
# Routes mcp.herbylab.dev / auth.herbylab.dev / trellis.herbylab.dev (and
# anything Travis adds in the Cloudflare dashboard) to in-network services
# on the shared `homelab` Docker network. Ingress rules live in the
# Cloudflare dashboard, NOT in this repo — token-mode auth.
#
# Usage:
#   docker compose -f docker-compose.yml up -d
#
# Env: reads .env (TUNNEL_TOKEN). .env is gitignored.

name: cloudflared

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared-mcp
    restart: unless-stopped
    command: tunnel run
    env_file:
      - .env
    environment:
      TUNNEL_TOKEN: ${TUNNEL_TOKEN}
    networks:
      - homelab

networks:
  homelab:
    external: true